CISA has issued revised federal patching requirements that compress response timelines for critical vulnerabilities. The directive establishes a three-day remediation window for the most severe flaws affecting federal systems, a tightened deadline reflecting the accelerating threat landscape driven by AI-powered exploitation.

The new guidance stratifies vulnerability severity into tiered response requirements. The highest-risk flaws now demand patching within 72 hours of patch availability. Medium-severity issues receive a 30-day window. Lower-risk vulnerabilities can be deferred with documented justification, allowing agencies flexibility for less critical systems.

The compressed timeline for critical flaws reflects a shift in federal cybersecurity posture. Federal agencies have historically operated under longer patching windows, sometimes 60 days or more for standard vulnerabilities. CISA attributes the acceleration to threats posed by AI-assisted vulnerability discovery and exploitation, which compress the window between vulnerability disclosure and weaponization.

The directive applies across federal civilian agencies and establishes baseline requirements for contractors handling federal data. Agencies must document patch deployment and maintain audit trails. Non-compliance triggers escalation reviews and potential enforcement action.

Implementation complexity looms for many agencies operating legacy infrastructure. Older systems lack automated patching capabilities, forcing manual updates that struggle to meet 72-hour deadlines. CISA acknowledges these constraints but maintains the deadline applies government-wide, with limited exceptions for documented technical barriers.

The guidance specifically targets vulnerabilities exploited in active attacks or those with public proof-of-concept code available. Zero-day flaws discovered and patched by vendors trigger the expedited timeline immediately upon vendor patch release.

Federal IT leaders report mixed reactions. Agencies with modern infrastructure applaud the clarity and reduced ambiguity around patching obligations. Agencies managing extensive legacy systems flag resource constraints. Some warn the timeline risks destabilizing older networks if patches introduce compatibility issues without adequate testing